PHP File Upload Validation Script

[cagintranet]

Hello All,

I am trying to create a page where my clients can upload files to me so that i can view them (sometimes email blocks/filters attachments, and plus this is much easier if i can get it working)

the page is here: http://www.cagintranet.com/ftp/indexnew.php

what i am trying to do is make sure someone has the validation code that i provide them before they are allowed to upload a file.

this is what i have so far:

<?php
echo "<br><FONT SIZE=2 face=arial COLOR=#000000><b>Upload all files here. Please be patient.</b> <br>You will receive an email from Cagintranet after we have confimed we received all your files.<br><br></font>";
$max="99999999"; //Maximum filesize in bytes
$validate="tempvalidationcode"; //validation code
if($action=="doupload") {
$picture = "fileupload"."_name";
$file1 = $$picture;
$file2 = "fileupload";
$file3 = $$file2;
if($file3 != "none"){
$filesizebtyes = filesize($file3);
if($validate = "validatebox") {
if(file_exists("$file3")&& $filesizebtyes <= "$max") {
copy ($file3, "$file1");
echo "<FONT SIZE=2 face=arial COLOR=#3366ff>File $file1 has been uploaded</font>";
} elseif($filesizebtyes <= "$max") {
copy ($file3, "$file1");
echo "<FONT SIZE=2 face=arial COLOR=#3366ff>File $file1 has been uploaded</font>";
}else{
echo "<FONT SIZE=2 face=arial COLOR=#990000>Filesize is greater than $max bytes</font>";
}
} else {
echo "<FONT SIZE=2 face=arial COLOR=#990000>Validation code entered is incorrect</font>";
}
}
}
echo"<br><br><FONT face=arial SIZE=2 COLOR=#000000>Validation Code: </font><input type=text name=validatebox size=8 class=formclass onfocus=this.style.backgroundColor='#FFFFCC' onblur=this.style.backgroundColor='#ffffff'><br><form ENCTYPE=multipart/form-data method=post action=?action=doupload>&nbsp;<input type=file name=fileupload class=formclass onfocus=this.style.backgroundColor='#FFFFCC' onblur=this.style.backgroundColor='#ffffff'>&nbsp;<input type=submit value=Upload class=formclass ></form><FONT face=arial SIZE=1 COLOR=#000000>Powered by <A HREF='http://www.cgixp.tk' target='_blank'>Smart PHP Uploader</A></FONT>";
?>

Right now as that code stands, people can submit anyhting whether they type in the validation code correctly or not. (also on a side note, is there any way to make sure they are entering in a valid file name in the browse box? The code allows you to type in c:\sdafasdfasdf and it would upload that file whether or not it exists on the local computer or not)

Any help would be greatly appricated!!

Chris

[T0PS3O]

It's be easier for us to read if you use the VB php tag.

Why don't you ask for validation first prior to offering the upload solution. Like a login? Then after they upload the file, you can get PHP to check the size. If it's virtually empty it must be wrong.

[cagintranet]

sorry, didnt know those tags existed..

<?php
echo "<br><FONT SIZE=2 face=arial COLOR=#000000><b>Upload all files here. Please be patient.</b> <br>You will receive an email from Cagintranet after we have confimed we received all your files.<br><br></font>";
$max="99999999"; //Maximum filesize in bytes
$validate="tempvalidationcode"; //validation code
if($action=="doupload") {
$picture = "fileupload"."_name";
$file1 = $$picture;
$file2 = "fileupload";
$file3 = $$file2;
if($file3 != "none"){
$filesizebtyes = filesize($file3);
if($validate = "validatebox") {
if(file_exists("$file3")&& $filesizebtyes <= "$max") {
copy ($file3, "$file1");
echo "<FONT SIZE=2 face=arial COLOR=#3366ff>File $file1 has been uploaded</font>";
} elseif($filesizebtyes <= "$max") {
copy ($file3, "$file1");
echo "<FONT SIZE=2 face=arial COLOR=#3366ff>File $file1 has been uploaded</font>";
}else{
echo "<FONT SIZE=2 face=arial COLOR=#990000>Filesize is greater than $max bytes</font>";
}
} else {
echo "<FONT SIZE=2 face=arial COLOR=#990000>Validation code entered is incorrect</font>";
}
}
}
echo"<br><br><FONT face=arial SIZE=2 COLOR=#000000>Validation Code: </font><input type=text name=validatebox size=8 class=formclass onfocus=this.style.backgroundColor='#FFFFCC' onblur=this.style.backgroundColor='#ffffff'><br><form ENCTYPE=multipart/form-data method=post action=?action=doupload>&nbsp;<input type=file name=fileupload class=formclass onfocus=this.style.backgroundColor='#FFFFCC' onblur=this.style.backgroundColor='#ffffff'>&nbsp;<input type=submit value=Upload class=formclass ></form><FONT face=arial SIZE=1 COLOR=#000000>Powered by <A HREF='http://www.cgixp.tk' target='_blank'>Smart PHP Uploader</A></FONT>";
?>

as for a login page... i am not too familiar on how to set permissions and sessions in php. I would be getting into a territory that i am not familiar with there. (i am open to the possibility.. i would just need some guidance)

Thanks

[noppid]

There are functions in php and html to do this job for you. If you utilize those as intended, it will get easier. However, you have to write the vaidation code.

http://www.cs.tut.fi/~jkorpela/forms/file.html
http://www.faqs.org/docs/htmltut/forms/_INPUT_TYPE_FILE.html

and look at the $_FILES['src'] php array.

[cagintranet]

noppid,

those are great sies for helping me understand the ftp/form attributes, but maybe i am just missing the help on validation. I read both pages you supplied, but cant find anything with that.

also, you said that it can be by html or PHP.. any way you can post an example? Thanks much

Chris

[noppid]

Humm, yeah, I have lot's of code to do that. It's just not that cut and dry.

What I showed you was relative to the html side. There is more to getting the file on the php side and evaluating the posted form, but I can't find a good example ATM.

I learned it by reading the php libs mostly and hard knocks. ;)

I probably should read the code in vBulletin for a better example. I need it too. LOL

What do you have access to? A program that does whatcha need is great to study.